CVE-2002-1131
Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to...
CVE-2002-1131 is a high vulnerability (CVSS 7.5) in Squirrelmail, published September 24, 2002. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 25.8%, the 97th percentile. No source names a fixed version.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 25.8%EPSS, 97th percentile
- Exploitation
- None known2 public exploits
- Fixed in
- No fix listedNo source names one
Description
Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via (1) addressbook.php, (2) options.php, (3) search.php, or (4) help.php.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squirrelmailDebian:3.0 From an advisory covering 3 CVEs | before 1.2.6-1.1 | 1.2.6-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | SquirrelMail 1.2.6/1.2.7 - Multiple Cross-Site Scripting Vulnerabilities | 2002-09-19 |
| Nuclei | SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting |
What each source reports
NVD Score used
Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via (1) addressbook.php, (2) options.php, (3) search.php, or (4) help.php.
- Record
CVE-2002-1131- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via (1) addressbook.php, (2) options.php, (3) search.php, or (4) help.php.
- Record
CVE-2002-1131- Updated
- 2026-11-02
EUVDEUVD-2002-1119No score
Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via (1) addressbook.php, (2) options.php, (3) search.php, or (4) help.php.
- Record
EUVD-2002-1119- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pjvq-p3hx-m7q2No score
Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to...
Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via (1) addressbook.php, (2) options.php, (3) search.php, or (4) help.php.
- Record
GHSA-pjvq-p3hx-m7q2- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
iss.net/security_center/static/10145.php
debian.org/security/2002/dsa-191
securityfocus.com/bid/5763
archives.neohapsis.com/archives/bugtraq/2002-09/0246.html
sourceforge.net/project/shownotes.php?group_id=311&release_id=110774
redhat.com/support/errata/RHSA-2002-204.html
nvd.nist.gov/vuln/detail/CVE-2002-1131
github.com/advisories/GHSA-pjvq-p3hx-m7q2